CAPA vs RCA: how root cause analysis and corrective and preventive action fit together

CAPA vs RCA: the difference in one minute

Root cause analysis (RCA) is the investigation. It asks why a deviation, complaint or out-of-specification (OOS) result happened. CAPA (corrective and preventive action) is the response: the actions that remove that cause, stop the problem coming back and stop it appearing somewhere else.

ICH Q10 ties the two together. It says a company's CAPA system covers actions "resulting from the investigation of complaints, product rejections, non-conformances, recalls, deviations, audits, regulatory inspections and findings", and that "a structured approach to the investigation process should be used with the objective of determining the root cause". CAPA without RCA is guesswork. RCA without CAPA changes nothing.

Source: EU GMP Chapter 1 (European Commission); ICH Q10; FDA QMSR final rule, 2 February 2024.

Correction, corrective action and preventive action

A correction deals with the problem in front of you. A corrective action deals with its cause. A preventive action deals with a cause that has not yet produced a problem.

ICH Q10 uses the ISO 9000 definitions: corrective action eliminates "the cause of a detected non-conformity" and preventive action eliminates "the cause of a potential non-conformity". Its note puts it simply: corrective action prevents recurrence, preventive action prevents occurrence. The FDA's QMSR final rule adds that a correction "may also refer to scrap, repair, rework, or adjustment".

• Correction: reject, rework or quarantine the affected batch.
• Corrective action: remove the cause on the line or process where it happened.
• Preventive action: apply the same fix to similar lines, products or sites that have not failed yet.

What the regulations require

Both EU and US rules expect a risk-based investigation that finds the cause, followed by actions whose effectiveness is checked.

EU GMP and ICH (medicines)

EU GMP Chapter 1, in operation since 31 January 2013, says "an appropriate level of root cause analysis should be applied during the investigation of deviations, suspected product defects and other problems". Where the true cause cannot be found, the most likely cause should be addressed. Where human error is blamed, that must be justified after checking that "process, procedural or system-based errors" have not been overlooked. CAPA effectiveness "should be monitored and assessed".

A revised Chapter 1, aligned with ICH Q9(R1), went to public consultation from September to 3 December 2025. As of October 2026 the European Commission's EudraLex page still lists the 2013 version. ICH Q10 says the effort and formality of an investigation should match the level of risk, in line with ICH Q9(R1) (adopted 18 January 2023). You can read both in our ICH Q10 summary and ICH Q9(R1) summary.

US medicines and medical devices

For medicines, 21 CFR 211.192 requires a thorough investigation of any unexplained discrepancy, with a written record including "conclusions and follow-up". The FDA's OOS guidance says that implicit in this "is the need to implement corrective actions and preventive actions".

For devices, the old CAPA section, 21 CFR 820.100, has gone. The Quality Management System Regulation took effect on 2 February 2026 and incorporates ISO 13485:2016 by reference. Corrective action now sits in ISO 13485 clause 8.5.2 and preventive action in clause 8.5.3, and the FDA says manufacturers "must verify or validate corrective and preventive actions to ensure that such actions are effective". See our 21 CFR 820 summary.

What the HPRA expects in Ireland

After a GMP inspection the HPRA sends its report within three weeks and asks for a response within about three weeks. Each response should include a root cause analysis and a CAPA proposal stating "what is going to be done, who will be responsible and when it will be completed". That matters across the 331 manufacturing sites on our Ireland pharma map, about 165 of them medtech plants, which now work to the QMSR when they supply the US.

Common RCA tools and when to use each

Pick the simplest tool that can explain the evidence. ICH Q9(R1) says highly formal methods are not always appropriate or necessary.

Source: ICH Q9(R1), Annex I (cause and effect diagrams, FMEA, fault tree analysis).

Worked example: an OOS result, step by step

This example is illustrative, not a real case. A tablet batch gives an assay result below its specification limit.

1. Contain. Put the batch on hold and record the OOS result. Keep the test preparations.
2. Phase I, laboratory check. The FDA OOS guidance asks for an initial assessment of the laboratory data, "whenever possible" before the test preparations are discarded. If there is clear lab error, the result is invalidated and the lab error gets its own CAPA.
3. Phase II, full-scale investigation. No lab error found, so the quality unit leads a wider review with manufacturing, maintenance and engineering. It checks production and sampling records, whether the problem has happened before, and other batches that could be affected, as 21 CFR 211.192 requires.
4. RCA. A fishbone session lists candidate causes. The evidence points to blending, so the team runs 5 Whys: low assay, because the blend was uneven; uneven, because the blend time was shorter; shorter, because a recipe parameter was changed; changed without challenge, because the change control form did not ask for a validation impact assessment. Root cause: a gap in change control, not "operator error".
5. CAPA. Correction: the batch is rejected. Corrective action: restore the validated blend time and add a validation impact question to change control. Preventive action: review other recipes changed under the old form.
6. Effectiveness check. Define in advance what success looks like, such as no repeat across a set number of batches and an audit of later change records, then record the result. EU GMP Chapter 1 requires this.

Our article on OOS investigations, root cause analysis and CAPA covers the laboratory phase in more depth.

Common inspection findings about CAPA

Weak investigations are among the findings regulators cite most. In the FDA's FY2025 inspection observations (inspections ending 1 October 2024 to 30 September 2025), the 21 CFR 211.192 citation for investigations of discrepancies and failures was the second most frequent drug observation, cited 164 times, behind quality unit procedures at 243. For devices, inadequate CAPA procedures under 820.100(a), the rule since replaced by the QMSR, was the top observation, cited 279 times.

An Irish case shows the pattern. The FDA's warning letter to Genzyme Ireland in Waterford, dated 22 June 2026, said the firm "cancelled numerous deviations without investigating the root cause or assessing product impact". Its own review of 74 cancelled deviations found 36 that needed investigation. The FDA said the responses fixed individual observations but lacked "a comprehensive plan that addresses the root cause" of the quality unit's failure. Read our analysis of the Sanofi Waterford warning letter and the Sanofi Ireland company page.

• Do not close or cancel a deviation before the root cause and product impact are assessed.
• Extend the investigation to other batches and products that could be affected.
• Look for the system cause behind individual findings.
• Justify any human error conclusion, and verify that actions worked.

See also our guides to FDA warning letters in Ireland and QA specialist pay.